Access control lists

This article describes details about the permissions available for the different workspace objects.

Access control lists overview

In SAP Databricks, you can use access control lists (ACLs) to configure permission to access workspace level objects. Workspace admins have the CAN MANAGE permission on all objects in their workspace, which gives them the ability to manage permissions on all objects in their workspaces. Users automatically have the CAN MANAGE permission for objects that they create.

Manage access control lists with folders

You can manage workspace object permissions by adding objects to folders. Objects in a folder inherit all permissions settings of that folder. For example, a user that has the CAN RUN permission on a folder has CAN RUN permission on the alerts in that folder.

If you grant a user access to an object inside the folder, they can view the parent folder's name, even if they do not have permissions on the parent folder. For example, a notebook named test1.py is in a folder named Workflows. If you grant a user CAN VIEW on test1.py and no permissions on Workflows, the user can see that the parent folder is named Workflows. The user cannot view or access any other objects in the Workflows folder unless they have been granted permissions on them.

Alerts ACLs

Ability	NO PERMISSIONS	CAN RUN	CAN MANAGE
See in alert list		x	x
View alert and result		x	x
Manually trigger alert run		x	x
Subscribe to notifications		x	x
Edit alert			x
Modify permissions			x
Delete alert			x

File ACLs

Ability	NO PERMISSIONS	CAN VIEW	CAN RUN	CAN EDIT	CAN MANAGE
Read file		x	x	x	x
Comment		x	x	x	x
Attach and detach file			x	x	x
Run file interactively			x	x	x
Edit file				x	x
Modify permissions					x

note

The workspace UI refers to view-only access as CAN VIEW, while the Permissions API uses CAN READ to represent the same level of access.

Folder ACLs

Ability	NO PERMISSIONS	CAN VIEW	CAN EDIT	CAN RUN	CAN MANAGE
List objects in folder	x	x	x	x	x
View objects in folder		x	x	x	x
Clone and export items			x	x	x
Run objects in the folder				x	x
Create, import, and delete items					x
Move and rename items					x
Modify permissions					x

Git folder ACLs

Ability	NO PERMISSIONS	CAN READ	CAN RUN	CAN EDIT	CAN MANAGE
List assets in a folder	x	x	x	x	x
View assets in a folder		x	x	x	x
Clone and export assets		x	x	x	x
Run executable assets in folder			x	x	x
Edit and rename assets in a folder				x	x
Create a branch in a folder					x
Switch branches in a folder					x
Pull or push a branch into a folder					x
Create, import, delete, and move assets					x
Modify permissions					x

Job ACLs

Ability	NO PERMISSIONS	CAN VIEW	CAN MANAGE RUN	IS OWNER	CAN MANAGE
View job details and settings		x	x	x	x
View results		x	x	x	x
Run now			x	x	x
Cancel run			x	x	x
Edit job settings				x	x
Delete job				x	x
Modify permissions				x	x

note

• The creator of a job has the IS OWNER permission by default.

• A job cannot have more than one owner.

• A group cannot be assigned the Is Owner permission as an owner.

• Jobs triggered through Run Now assume the permissions of the job owner and not the user who issued Run Now.

• Jobs access control applies to jobs displayed in the Databricks Jobs UI and their runs. It doesn't apply to:

  • Notebook workflows that run modular or linked code. These use the permissions of the notebook itself. If the notebook comes from Git, a new copy is created and its files inherit the permissions of the user who triggered the run.

  • Jobs submitted by API. These use the notebook's default permissions unless you explicitly set the access_control_list in the API request.

MLflow experiment ACLs

MLflow experiment ACLs are different for notebook experiments and workspace experiments. Notebook experiments cannot be managed independently of the notebook that created them, so the permissions are similar to notebook permissions.

Notebook ACLs

Ability	NO PERMISSIONS	CAN VIEW	CAN RUN	CAN EDIT	CAN MANAGE
View cells		x	x	x	x
Comment		x	x	x	x
Run using %run or notebook workflows		x	x	x	x
Attach and detach notebooks			x	x	x
Run commands			x	x	x
Edit cells				x	x
Modify permissions					x

Query ACLs

Ability	NO PERMISSIONS	CAN VIEW	CAN RUN	CAN EDIT	CAN MANAGE
View own queries		x	x	x	x
See in query list		x	x	x	x
View query text		x	x	x	x
View query result		x	x	x	x
Refresh query result (or choose different parameters)			x	x	x
Edit query text				x	x
Modify permissions					x
Delete query					x

Secret ACLs

Ability	READ	WRITE	MANAGE
Read the secret scope	x	x	x
List secrets in the scope	x	x	x
Write to the secret scope		x	x
Modify permissions			x

Serving endpoint ACLs

Ability	NO PERMISSIONS	CAN VIEW	CAN QUERY	CAN MANAGE
Get endpoint		x	x	x
List endpoint		x	x	x
Query endpoint			x	x
Update endpoint config				x
Delete endpoint				x
Modify permissions				x

SQL warehouse ACLs

Ability	NO PERMISSIONS	CAN VIEW	CAN MONITOR	CAN USE	IS OWNER	CAN MANAGE
Start the warehouse			x	x	x	x
View warehouse details		x	x	x	x	x
View warehouse queries		x	x		x	x
Run queries			x	x	x	x
View warehouse monitoring tab		x	x		x	x
Stop the warehouse					x	x
Delete the warehouse					x	x
Edit the warehouse					x	x
Modify permissions					x	x

Vector search endpoint ACLs

Ability	NO PERMISSIONS	CAN CREATE	CAN USE	CAN MANAGE
Get endpoint		x	x	x
List endpoints		x	x	x
Create endpoint		x	x	x
Use endpoint (create index)			x	x
Delete endpoint				x
Modify permissions				x